1 /* 2 * This file and its contents are supplied under the terms of the 3 * Common Development and Distribution License ("CDDL"), version 1.0. 4 * You may only use this file in accordance with the terms of version 5 * 1.0 of the CDDL. 6 * 7 * A full copy of the text of the CDDL should have accompanied this 8 * source. A copy of the CDDL is also available via the Internet at 9 * http://www.illumos.org/license/CDDL. 10 */ 11 12 /* Copyright 2015, Richard Lowe. */ 13 14 #include <err.h> 15 #include <errno.h> 16 #include <grp.h> 17 #include <libintl.h> 18 #include <procfs.h> 19 #include <project.h> 20 #include <pwd.h> 21 #include <stdio.h> 22 #include <stdlib.h> 23 #include <string.h> 24 #include <sys/secflags.h> 25 #include <sys/types.h> 26 27 #include <libproc.h> 28 #include <libzonecfg.h> 29 30 extern const char *__progname; 31 32 static void 33 print_flags(const char *set, secflagset_t flags) 34 { 35 char buf[1024]; 36 37 secflags_to_str(flags, buf, sizeof (buf)); 38 (void) printf("\t%s:\t%s\n", set, buf); 39 } 40 41 /* 42 * Structure defining idtypes known to the priocntl command 43 * along with the corresponding names. 44 * The idtype values themselves are defined in <sys/procset.h>. 45 */ 46 static struct idtypes { 47 idtype_t type; 48 char *name; 49 } idtypes [] = { 50 { P_ALL, "all" }, 51 { P_CTID, "contract" }, 52 { P_CTID, "ctid" }, 53 { P_GID, "gid" }, 54 { P_GID, "group" }, 55 { P_PGID, "pgid" }, 56 { P_PID, "pid" }, 57 { P_PPID, "ppid" }, 58 { P_PROJID, "project" }, 59 { P_PROJID, "projid" }, 60 { P_SID, "session", }, 61 { P_SID, "sid" }, 62 { P_SID, "sid" }, 63 { P_TASKID, "taskid" }, 64 { P_UID, "uid" }, 65 { P_UID, "user" }, 66 { P_ZONEID, "zone" }, 67 { P_ZONEID, "zoneid" }, 68 { 0, NULL } 69 }; 70 71 static int 72 str2idtype(char *idtypnm, idtype_t *idtypep) 73 { 74 struct idtypes *curp; 75 76 for (curp = idtypes; curp->name != NULL; curp++) { 77 if (strncasecmp(curp->name, idtypnm, 78 strlen(curp->name)) == 0) { 79 *idtypep = curp->type; 80 return (0); 81 } 82 } 83 return (-1); 84 } 85 86 static id_t 87 getid(idtype_t type, char *value) 88 { 89 struct passwd *pwd; 90 struct group *grp; 91 id_t ret; 92 char *endp; 93 94 switch (type) { 95 case P_UID: 96 if ((pwd = getpwnam(value)) != NULL) 97 return (pwd->pw_uid); 98 break; 99 case P_GID: 100 if ((grp = getgrnam(value)) != NULL) 101 return (grp->gr_gid); 102 break; 103 case P_PROJID: 104 if ((ret = getprojidbyname(value)) != (id_t)-1) 105 return (ret); 106 break; 107 case P_ZONEID: 108 if (zone_get_id(value, &ret) == 0) 109 return (ret); 110 break; 111 default: 112 break; 113 } 114 115 errno = 0; 116 117 ret = (id_t)strtoul(value, &endp, 10); 118 119 if ((errno != 0) || (*endp != '\0')) 120 return ((id_t)-1); 121 122 return (ret); 123 } 124 125 int 126 main(int argc, char **argv) 127 { 128 secflagdelta_t act; 129 psecflagwhich_t which = PSF_INHERIT; 130 int ret = 0; 131 int pgrab_flags = PGRAB_RDONLY; 132 int opt; 133 char *idtypename = NULL; 134 idtype_t idtype = P_PID; 135 boolean_t usage = B_FALSE; 136 boolean_t e_flag = B_FALSE; 137 boolean_t l_flag = B_FALSE; 138 boolean_t s_flag = B_FALSE; 139 int errc = 0; 140 141 while ((opt = getopt(argc, argv, "eFi:ls:")) != -1) { 142 switch (opt) { 143 case 'e': 144 e_flag = B_TRUE; 145 break; 146 case 'F': 147 pgrab_flags |= PGRAB_FORCE; 148 break; 149 case 'i': 150 idtypename = optarg; 151 break; 152 case 's': 153 s_flag = B_TRUE; 154 if ((strlen(optarg) >= 2) && 155 ((optarg[1] == '='))) { 156 switch (optarg[0]) { 157 case 'L': 158 which = PSF_LOWER; 159 break; 160 case 'U': 161 which = PSF_UPPER; 162 break; 163 case 'I': 164 which = PSF_INHERIT; 165 break; 166 case 'E': 167 errx(1, "the effective flags cannot " 168 "be changed", optarg[0]); 169 default: 170 errx(1, "unknown security flag " 171 "set: '%c'", optarg[0]); 172 } 173 174 optarg += 2; 175 } 176 177 if (secflags_parse(NULL, optarg, &act) == -1) 178 errx(1, "couldn't parse security flags: %s", 179 optarg); 180 break; 181 case 'l': 182 l_flag = B_TRUE; 183 break; 184 default: 185 usage = B_TRUE; 186 break; 187 } 188 } 189 190 argc -= optind; 191 argv += optind; 192 193 if (l_flag && ((idtypename != NULL) || s_flag || (argc != 0))) 194 usage = B_TRUE; 195 if ((idtypename != NULL) && !s_flag) 196 usage = B_TRUE; 197 if (e_flag && !s_flag) 198 usage = B_TRUE; 199 if (!l_flag && argc <= 0) 200 usage = B_TRUE; 201 202 if (usage) { 203 (void) fprintf(stderr, 204 gettext("usage:\t%s [-F] { pid | core } ...\n"), 205 __progname); 206 (void) fprintf(stderr, 207 gettext("\t%s -s spec [-i idtype] id ...\n"), 208 __progname); 209 (void) fprintf(stderr, 210 gettext("\t%s -s spec -e command [arg]...\n"), 211 __progname); 212 (void) fprintf(stderr, gettext("\t%s -l\n"), __progname); 213 return (2); 214 } 215 216 if (l_flag) { 217 secflag_t i; 218 const char *name; 219 220 for (i = 0; (name = secflag_to_str(i)) != NULL; i++) 221 (void) printf("%s\n", name); 222 return (0); 223 } else if (s_flag && e_flag) { 224 /* 225 * Don't use the strerror() message for EPERM, "Not Owner" 226 * which is misleading. 227 */ 228 errc = psecflags(P_PID, P_MYID, which, &act); 229 switch (errc) { 230 case 0: 231 break; 232 case EPERM: 233 errx(1, gettext("failed setting " 234 "security-flags: Permission denied")); 235 break; 236 default: 237 err(1, gettext("failed setting security-flags")); 238 } 239 240 (void) execvp(argv[0], &argv[0]); 241 err(1, "%s", argv[0]); 242 } else if (s_flag) { 243 int i; 244 id_t id; 245 246 if (idtypename != NULL) 247 if (str2idtype(idtypename, &idtype) == -1) 248 errx(1, gettext("No such id type: '%s'"), 249 idtypename); 250 251 for (i = 0; i < argc; i++) { 252 if ((id = getid(idtype, argv[i])) == (id_t)-1) { 253 errx(1, gettext("invalid or non-existent " 254 "identifier: '%s'"), argv[i]); 255 } 256 257 /* 258 * Don't use the strerror() message for EPERM, "Not 259 * Owner" which is misleading. 260 */ 261 if (psecflags(idtype, id, which, &act) != 0) { 262 switch (errno) { 263 case EPERM: 264 errx(1, gettext("failed setting " 265 "security-flags: " 266 "Permission denied")); 267 break; 268 default: 269 err(1, gettext("failed setting " 270 "security-flags")); 271 } 272 } 273 } 274 275 return (0); 276 } 277 278 /* Display the flags for the given pids */ 279 while (argc-- > 0) { 280 struct ps_prochandle *Pr; 281 const char *arg; 282 psinfo_t psinfo; 283 prsecflags_t *psf; 284 int gcode; 285 286 if ((Pr = proc_arg_grab(arg = *argv++, PR_ARG_ANY, 287 pgrab_flags, &gcode)) == NULL) { 288 warnx(gettext("cannot examine %s: %s"), 289 arg, Pgrab_error(gcode)); 290 ret = 1; 291 continue; 292 } 293 294 (void) memcpy(&psinfo, Ppsinfo(Pr), sizeof (psinfo_t)); 295 proc_unctrl_psinfo(&psinfo); 296 297 if (Pstate(Pr) == PS_DEAD) { 298 (void) printf(gettext("core '%s' of %d:\t%.70s\n"), 299 arg, (int)psinfo.pr_pid, psinfo.pr_psargs); 300 } else { 301 (void) printf("%d:\t%.70s\n", 302 (int)psinfo.pr_pid, psinfo.pr_psargs); 303 } 304 305 if (Psecflags(Pr, &psf) != 0) 306 err(1, gettext("cannot read secflags of %s"), arg); 307 308 print_flags("E", psf->pr_effective); 309 print_flags("I", psf->pr_inherit); 310 print_flags("L", psf->pr_lower); 311 print_flags("U", psf->pr_upper); 312 313 Psecflags_free(psf); 314 Prelease(Pr, 0); 315 } 316 317 return (ret); 318 } 319